Crowdstrike_falcon error: "Cannot save log because of validation errors:...
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 377
- Forks
- 280
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 10
Description
OS: Ubuntu 18.04
MISP: v2.4.123 (55bcc4fa470af0bd24db0128e3b2cf3919af1c7e)
This was, originally, #5710 in the MISP issues but I am opening it, here, instead. I am getting the following errors when I try to test the crowdstrike_falcon module using CURL. The credentials are ok and the data are in Crowdstrike but what is returned is an empty array:
[2020-03-24 10:20:27] main.INFO: got {"queue":"prio","id":"7f08bee11f3c977af36cb1e9b5c238a0","class":"EventShell","args":[["enrichment","2","1393","["crowdstrike_falcon"]","1487"]]} {"type":"got","args":"[object] (Resque_Job: {"queue":"prio","id":"7f08bee11f3c977af36cb1e9b5c238a0","class":"EventShell","args":[["enrichment","2","1393","[\"crowdstrike_falcon\"]","1487"]]})","worker":"XXXX:4333"} []
[2020-03-24 10:20:27] main.INFO: Processing ID:7f08bee11f3c977af36cb1e9b5c238a0 in prio {"type":"process","worker":"XXXX:4333","job_id":"7f08bee11f3c977af36cb1e9b5c238a0"} []
[2020-03-24 10:20:29] main.ERROR: {"queue":"prio","id":"7f08bee11f3c977af36cb1e9b5c238a0","class":"EventShell","args":[["enrichment","2","1393","["crowdstrike_falcon"]","1487"]]} failed: Cannot save log because of validation errors: {"action":["Options : ..."]} {"type":"fail","log":"Cannot save log because of validation errors: {"action":["Options : ..."]}","job_id":"7f08bee11f3c977af36cb1e9b5c238a0","time":1776,"worker":"XXXX:4333"} []
I re-installed MISP Modules but it had no effect. It may be affecting other Enrichments besides Crowdstrikes. I haven't tested. Also, this instance was installed using the Ubunto 18.04 INSTALL script.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the crowdstrike_falcon enrichment request with CURL on the reported MISP v2.4.123 and Ubuntu 18.04 setup, then inspect the logged EventShell job and the validation error for the action field. Compare the empty CrowdStrike response with the failing log creation; done means the enrichment completes without the validation error and returns the expected data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100